c0fb53548c
The userinfo check read the authority after `//`, so `https:\\alice:pw@host`, `https:alice:pw@host` and `https:/\alice:pw@host` passed. object.url now refuses any `?`, `#`, `@` or `\`, a path `@` included, so no query, fragment or user information enters an observation however a parser splits the URL. Corpus cases for the three bypasses, a backslash alone and a path `@`; the escaped-URL observation keeps a quote (its backslash moved out with the rule). Section 8.2 also states that no syntax keeps an address, a token or personal data out of `cid`: an emitter MUST NOT put one there, and the charset stays a syntax rule. Co-Authored-By: Claude Opus 5.5 <[email protected]>
30 lines
689 B
JSON
30 lines
689 B
JSON
[
|
|
"unknown-member",
|
|
"missing-member",
|
|
"version-2",
|
|
"sid-not-hex",
|
|
"event-mode-without-time",
|
|
"sn-past-2-53",
|
|
"ts-past-sf-integer",
|
|
"claim-before-end",
|
|
"unknown-event",
|
|
"response-key-on-request",
|
|
"request-key-on-response",
|
|
"switch-to-same-path",
|
|
"switch-unknown-reason",
|
|
"pin-refused-without-reason",
|
|
"object-type-unknown",
|
|
"cid-past-64",
|
|
"cid-an-address",
|
|
"cid-a-url",
|
|
"url-with-query",
|
|
"url-with-fragment",
|
|
"url-with-userinfo",
|
|
"url-userinfo-behind-backslashes",
|
|
"url-userinfo-without-slashes",
|
|
"url-userinfo-behind-a-mixed-separator",
|
|
"url-with-a-backslash",
|
|
"url-with-an-at-in-its-path",
|
|
"present-zero-layers",
|
|
"cohort-unknown"
|
|
]
|